CVE Feed

    Dashboard / CVE / CVE-2015-1428

    CVE-2015-1428

    Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.

    Published:Feb 3, 2015
    Last Modified:Apr 12, 2025
    EPS:Feb 3, 2015
    EPSS Score:0.01412
    CVSS Score:7.5

    Affected Products

    Vendor
    Sefrengo
    Product
    Sefrengo

    Exploits

    http://www.exploit-db.com/exploits/35972http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.htmlhttp://www.exploit-db.com/exploits/35972http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.htmlhttps://www.exploit-db.com/exploits/35972

    References

    http://www.exploit-db.com/exploits/35972
    http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html
    http://www.securityfocus.com/archive/1/534593/100/0/threaded
    https://github.com/sefrengo-cms/sefrengo-1.x/commit/0b1edd4b22a47743eff7cfaf884ba2a4e06e15eb
    https://github.com/sefrengo-cms/sefrengo-1.x/commit/22c0d16bfd715631ed317cc990785ccede478f07
    http://www.exploit-db.com/exploits/35972
    http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html
    http://www.securityfocus.com/archive/1/534593/100/0/threaded
    https://github.com/sefrengo-cms/sefrengo-1.x/commit/0b1edd4b22a47743eff7cfaf884ba2a4e06e15eb
    https://github.com/sefrengo-cms/sefrengo-1.x/commit/22c0d16bfd715631ed317cc990785ccede478f07

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High